An unauthenticated remote code execution vulnerability in vLLM allows attackers to execute arbitrary code on the host server by providing a malicious model repository path.

The software improperly handles Hugging Face auto_map dynamic modules during model resolution by failing to gate them with trust_remote_code. This flaw allows an unauthenticated attacker to trigger arbitrary code execution on the host system during the model loading process.

Successful exploitation of this vulnerability grants an attacker full control over the host server, leading to complete system compromise. Given the CVSS score of 8.8, this represents a critical risk that could result in the exfiltration of sensitive model data, unauthorized access to the underlying infrastructure, or the deployment of persistent malware.

Immediate Action: Update the vLLM package to version 0.14.0 or later immediately to resolve the improper code execution path.

Proactive Monitoring: Review server logs for unusual model loading activities or unexpected process spawns occurring during the initialization phase.

Compensating Controls: Restrict access to the vLLM environment to trusted networks and ensure that model repositories are sourced only from verified and secure locations to prevent the loading of malicious code.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

The severity of this vulnerability necessitates immediate action, as it provides a direct path to full system compromise without requiring user credentials. Organizations running vLLM within the affected version range must prioritize upgrading to version 0.14.0 to neutralize the risk. Failure to patch will leave the infrastructure exposed to trivial remote code execution attacks.